Exchange 2007 – Snags during my upgrade
This week I had some time to spend in my lab at home, so I thought I would catch up on some overdue projects, My biggest project was to get my lab up to Exchange 2007 from 2003. The complication here is that although I have a rack of “real” servers, I don’t have any spare capacity.
Virtual PC to the rescue! I grabbed a spare laptop from our inventory at the office, and snagged a copy of my sysprep’d Windows Server 2003 R2 image and installed Exchange 2007.
I decided to write about my experience so that the search engines catch it, and hopefully get you on your way quicker.
Mailbox Migration
After updating my AD schema and making reasonably sure that the 2007 box could talk to the 2003 box, I moved my mailbox. I checked, and I could still access my mailbox through OWA, RPC/HTTP, Local MAPI, and EAS (still accessed through the EX2003 box via publishing rules on my ISA 2006 box). Since all of this worked, I migrated over the 20 or so mailboxes that I host for friends.
Since I didn’t have any spare boxes, I would have to pave my old EX2003 box, install Exchange 2007, and move the mailboxes back off the VPC Exchange server. I decided to take an outage and didn’t change the ISA publishing rules to the new EX2007 box, so I don’t know if Exchange out of the box worked for me (something that in retrospect might have helped me). Uninstalling EX2003 was uneventful. I had to turn off NNTP and SMTP to allow EX2007 to install on the box, as well as apply a .NET hotfix that the installer guided me to install.
The “real hardware” EX2007 box was up and running, and was part of the Org. I moved the mailboxes back, and did a quick check with a local Outlook client to ensure I could still get to mailboxes.
Decommissioning the EX2007 VPC
This is where I hit my first real snag. I took care to move mailboxes and Public Folders over to the “Real EX2007” server. I wanted to ensure that everything was moved over by deleting the Mailbox and Public Folder database before I did the uninstall. When I tried to delete the Public Folders database using the GUI I kept getting this error:
--------------------------------------------------------
Microsoft Exchange Error
--------------------------------------------------------
The public folder database 'Public Folder Database' cannot be deleted.
Public Folder Database Failed
Error:
The public folder database specified contains folder replicas. Before deleting the public folder database, remove the folders or move the replicas to another public folder database.
--------------------------------------------------------
OK
--------------------------------------------------------
With the help of some really smart Exchange product team guys, they pointed me to a couple TechNet articles:
How to Remove a Public Folder Database
How to Remove the Last Public Folder Database in the Organization
For those with link impairment, and for the sake of search engines, I ran the following commands to resolve this issue:
Get-PublicFolder -Server <server with public folder database> "\" -Recurse -ResultSize:Unlimited | Remove-PublicFolder -Server <server with public folder database> -Recurse -ErrorAction:SilentlyContinue
Get-PublicFolder -Server <server with public folder database> "\Non_Ipm_Subtree" -Recurse -ResultSize:Unlimited | Remove-PublicFolder -Server <server with public folder database> -Recurse -ErrorAction:SilentlyContinue
Remove-PublicFolderDatabase -Identity "<server>\<storage group>\<public folder database>"
NOTE: This is where I had my first Eureka! moment. The GUI sucks, you can’t do much more than very basic management from the new Exchange System Management console. The Shell is where it’s at, the more you use it, the more you like it.
So all is good in the world: no more mailboxes or public folders on the EX2007 VPC. When I try and remove Exchange 2007, I started getting the error:
“this computer is configured as a bridgehead server for 1 routing group connector(s) in the organization. These must be moved or deleted before setup can continue”
Again, product team guys easily direct me to the good Exchange 2007 documentation regarding the cmdlets in the shell.
In this case, the GUI didn’t show any routing group connectors (please see my note above about how much the GUI is a waste of time). So, I had to use a command to first find out the names of the routing group connector and then delete it. I ran the following commands:
Get-RoutingGroupConnector [-Identity <RoutingGroupConnectorIdParameter>] [-DomainController <Fqdn>]
Remove-RoutingGroupConnector -Identity <RoutingGroupConnectorIdParameter> [-DomainController <Fqdn>]
Phew, after deleting the server-to-server routing connector I was able to uninstall EX2007 from the VPC.
Can’t send or receive email
After numerous attempts to send and receive email from internal and external clients, I wasn’t able to send or receive internal or external email. I tried using the queue viewer tool in the GUI, and it didn’t give me any clues. I figured I was missing an external send connector, and a quick glance at the GUI verified my assumption (reminder to self: must stop using the GUI). To polish my mad Shell skillz further, I decided to create an external connector for all external domains (*) using the following command:
New-SendConnector -Name <String> -AddressSpaces <MultiValuedProperty> [-AuthenticationCredential <PSCredential>] [-Comment <String>] [-ConnectionInactivityTimeOut <EnhancedTimeSpan>] [-DNSRoutingEnabled <$true | $false>] [-DomainController <Fqdn>] [-DomainSecureEnabled <$true | $false>] [-Enabled <$true | $false>] [-Force <SwitchParameter>] [-ForceHELO <$true | $false>] [-Fqdn <Fqdn>] [-IgnoreSTARTTLS <$true | $false>] [-MaxMessageSize <Unlimited>] [-Port <Int32>] [-ProtocolLoggingLevel <None | Verbose>] [-RequireTLS <$true | $false>] [-SmartHostAuthMechanism <None | BasicAuth | BasicAuthRequireTLS | ExchangeServer | ExternalAuthoritative>] [-SmartHosts <MultiValuedProperty>] [-SourceIPAddress <IPAddress>] [-SourceTransportServers <MultiValuedProperty>] [-TemplateInstance <PSObject>] [-Usage <Custom | Internal | Internet | Partner>] [-UseExternalDNSServersEnabled <$true | $false>]
After creating the send connector, I thought my troubles were over. Wrong! Nothing was working. I did a quick telnet to my server on port 25 and got the error:
“452 4.3.1. Insufficient system resources
Connection to host lost.
Press any key to continue…”
Well, it just so happens that this machine had two partitions, one for OS and one for the stores. By default the SMTP queue is located on the C drive, which only had about 1GB left. Exchange 2007 has a “Back Pressure” feature that disables the SMTP queue when there is low disk space. Unfortunately, there is no handy-dandy shell command to move the queue location. There is a pretty good article up on Technet that tells you how to Change the location of the Queue Database, It involves moving some files, granting “Full Control” to the network service on the new directory, and editing an XML file that contains the location of the queue. I also spotted a way to disable the Back Pressure feature. Just sucks that this isn’t in the Shell….
Immediately after this adjustment I got a shotgun of test emails, and the queue monitor lit up light a Christmas tree.
Certificates, OWA, and ISA
Because I want my buddies to be able to use OWA, EAS and RPC/HTTP securely, I have a public SSL certificate (really cheap from GoDaddy.com). Exchange actually generates its own certificates which is great, but doesn’t really work for my purposes. I also wanted to have ISA do the forms authentication, so I had to have the SSL cert on both the ISA server and Exchange box. It was pretty routine to export the cert with public key and install it on ISA using certificate manager.
I used the ISA publishing wizard for Exchange 2007 for OWA and it made it pretty brainless. I also published IMAP and POP3 for those friends I have that aren’t quite on the RPC/HTTP bandwagon. Additionally, I had already published the SMTP server and created a rule to allow outgoing SMTP from the Exchange server.
When I tried OWA, I kept getting the following Error:
500 Internal Server Error – The target principal name is incorrect”
Turns out that ISA’s interface in 2006 has changed a bit, and was misleading for me. I had created an HTTPS listener with the SSL cert, and everything looked good. ISA allows you to “bridge” the names by allowing you to have an “outside” name and route it to an “internal” name. Turns out, that on the “To” tab of the OWA publishing rule, I had mistakenly specified the “outside” DNS name of instead of my internal server. To set this up correctly, it needs to be:
This rule applies to this published site:
Mail.mydomain.com (external certificate name)
Computer name or IP address (required if the internal site name is different or not resolvable):
10.1.1.1
Summary
When I setup numerous Exchange 2003 servers for customers, I have a set way of doing it. And between having done it a bunch of times, and most of the tweaking in the GUI, 2003 seems easier. That said, I think that if you set the expectation that the Shell is your new config tool, it isn’t much harder. I really like the flexibility of the Shell, and I assume we took the Shell approach because the GUI would be impossibly complex to design for effective management especially with the Unified Communication components.
On your side, Microsoft has provided great documentation this time and it is already published on Technet and other resources.
Is it worth the hassle? Heck ya. Can you run setup.exe and be ready to go in 20 minutes? Nope. This is a complex, powerful product with lots of options. But, most admins familiar with Exchange should not have many issues getting it up and going.
